zz-meridian 0.2.0 → 0.4.0

package/dist/adopt.js

@@ -12,7 +12,7 @@ import { PAYLOAD, VERSION, brandArgs, inside, installSkill, packageManager, payl
 /** The library modules Meridian's components and gates import; the rest of src/lib belongs to the template's pages. */
 const LIB = ['cn', 'format', 'format-date', 'period', 'color', 'host', 'preferences', 'csv', 'safe-markdown'].map((n) => `src/lib/${n}.ts`);
 /** What adopt copies from the template, as payload paths. The fixture build in CI is what keeps this list complete. */
-export function adoptSet() {
+function adoptSet() {
     const own = (f) => !/(^|\/)(README\.md|preview\.tsx)$/.test(f);
     return [
         ...payloadFiles('tokens'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zz-meridian",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Bring ZZ Meridian, a dashboard design system, into a Next.js project, or start a new dashboard on it. Copies the files in; nothing depends on this package at runtime.",
   "license": "MIT",
   "type": "module",

package/payload/.env.example

@@ -8,6 +8,8 @@
 # ASSISTANT_API_KEY=
 
 # The model's id, as the provider names it. It must be able to call tools.
+# A gateway (LiteLLM, OpenRouter and the like) often names models "<provider>.<model>": copy the id
+# from the gateway's GET /models, and take it exactly as it comes — the prefix is part of the name.
 # ASSISTANT_MODEL=
 
 # The provider's address. Required for "openai-compatible"; optional for "anthropic".

package/payload/CHANGELOG.md

@@ -2,6 +2,109 @@
 
 Every release of ZZ Meridian, newest first. Versions follow semver: a removed or renamed token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. Each entry says what breaks and what to do instead.
 
+## [0.4.0] · 2026-10-05
+
+A quality pass over the whole repository, and a manual pass through the running product — every page, embed, Atlas
+view, CLI command and API route, at both widths and both themes. Twenty-two defects fixed, six of them found only by
+auditing the Atlas, which nothing had done before. Both field reports on #6 and #7 are in.
+
+### Security
+
+- **The markdown URL policy could be bypassed with a control character** (`src/lib/safe-markdown.ts`). The scheme was read from the raw string, but a browser removes tab, newline and the other controls from a URL before it reads one: `java\tscript:alert(1)` IS `javascript:` to the browser, so a link an agent, a document or a note wrote could reach a script — the one thing this module exists to stop. The scheme is now read from a copy with the controls and spaces taken out, and only the probe is stripped: a URL that passes is returned exactly as written. `tests/prose.test.tsx` covers the obfuscated forms.
+
+### Fixed
+
+- **`scripts/keyboard.ts` could fail a page that was right.** It judged a focused control two frames after the key event, and the skip link is drawn off the top edge until `:focus-visible` moves it in — so a measurement taken in between clamped to the page's corner, found the sticky bar there, and reported `hidden under div.flex.h-16: Skip to content`. That failed the `gates` job of the 0.4.0 release, on `/keys`, while the same page passed here and in the dry run: a race, not a covered control. It now takes a second look 150 ms later before calling a control covered, which a control genuinely under something cannot pass.
+- **`scripts/keyboard.ts` failed a page that was right.** Its control selector asked for `button:not([disabled])`, `input:not([disabled])` and so on — the *attribute*, which only a control's own markup carries — so a control disabled by a `<fieldset disabled>` was counted as one the keyboard should reach, and Tab (which correctly skips it) never arrived. A `FormSection` in its read-only or saving state is exactly that, so its Atlas page and its preview both failed with "never reached: INPUT" — a check crying wolf on the component it ships. The selector asks for the state now (`:disabled`), which is what the audit's own target check already did. Both routes pass; reverting the selector fails them again.
+- **The assistant's whole panel was in every page's first load** (issue #7). `AppShell` loaded `AssistantColumn` *and* `AssistantLauncher` through `dynamic(() => import('@/components/patterns/assistant'))` — the same barrel — so the chunk a page fetched to draw its launcher button carried `useChat`, the AI SDK's client and its zod schemas, `react-markdown`, `remark-gfm` and `micromark`: 448 KB in the reporting product's build, on every page, whether or not anybody opened the panel. The launcher is its own module now (`assistant/launcher.tsx`, which imports only the Agent Mark), and the column mounts the first time the panel is opened and stays mounted after, so the thread still survives closing and reopening. The measurement, from the report: 1,152-1,219 KB of JS per page before, 696-761 KB after, with 456 KB arriving on the first open.
+- **`verify`'s "assistant off" start could be turned back on by `.env.local`** (issue #7). It deleted every `ASSISTANT_*` variable from the environment it passed on, but `next start` loads `.env.local` itself and Next does not overwrite a variable that is already set — so a person keeping their own model there got "/ has 1 assistant element(s)" while nothing was wrong. The variables are blanked instead, which is what `assistantConfig` reads as unset.
+- **Nothing checked what a page actually downloads.** `vitals.ts` measures LCP, INP and CLS, and all three stayed green while the panel's chunk rode along on every page. `scripts/assistant.ts` measures the split directly: it lists the page's scripts with the panel closed, opens the panel, and fails when opening it fetched no script the closed page lacked — which is exactly what "the launcher carries the panel" looks like from the browser.
+- **The guides said nothing about reading a table once per request** (issue #7). A console page asks for the same records from several places — the shell tools, a page strip, the page and its freshness stamp — which is free over the sample's fixtures and a round trip each over a network. `src/data/collections.ts`'s header, `references/customize.md` and `references/existing-project.md` now say to wrap the read in `cache()` from `react`, to keep the write path reading directly so validation never sees an earlier answer, and to raise `pg`'s ten-second idle timeout. The reporting product's three heaviest pages answered 44-46% sooner for the first.
+- **A DataTable drew both of its layouts on every render** (issue #6). The component rendered the table *and* a `<ul>` of the same records, and let CSS hide one: every cell function ran twice on mount and again on every filter, sort or page change, both trees reached the DOM at every viewport, and each device downloaded a tree it could never show — on the reporting product's `/activity` that was 201 of 711 elements hidden and unusable. It draws one tree now: the real `<table>` at every width, its rows laid out as cards below 768px in CSS. Each cell carries `data-mobile` — `check`, `title`, `status`, `fact` or `hidden` — naming its part of the card, and the row becomes a six-column grid. Nothing is measured, so there is no hydration swap and no flash: a phone gets the card in the server's HTML exactly as before. A column the table dropped for width (`hideBelow`) comes back in the card, which is what the old list did. The only render left over is the phone wording for a column that declares `mobileCell` ("Used 1 min ago" beside "1 min ago") — a few words, never a second copy of the row. `tests/data-table.test.tsx` holds it.
+- **Two tabs of the same dashboard disagreed about the theme, accent and density** (`Providers`). The stored choice was read once on mount and never again, so a person who switched to the light theme in one tab kept the dark one in the other until it reloaded. `Providers` now follows the `storage` event, which fires only in the tabs that did not write — exactly the ones that need it. `tests/preferences.test.tsx` holds it (and fails without the listener).
+- **`Sparkline` drew a stray filled triangle for fewer than two values.** `Math.min()`/`Math.max()` over an empty array give ±Infinity, and the area path closed with them; the README promised "under two values, render nothing". It renders nothing now, and `tests/sparkline.test.tsx` holds it — with the guard removed it fails on exactly the degenerate path (`d="L120,36L0,36Z"`), which a real ResizeObserver would have drawn.
+- **`formatCompact` rendered a negative in full** — `formatCompact(-1_500_000)` was "-1,500,000" in a tile while an axis rendered the same number as "-1.5M". Every branch turns on the magnitude now, as the axis formatter already did.
+- **`FeaturedMetric` crashed on a figure its splitter did not recognise.** `text.match(...)` was dereferenced without a null test, so a formatter returning "—", a negative, or any currency symbol other than `$`/`€`/`£` threw. Both it and `MetricTile` now share one total parser, `splitFigure` in `src/lib/format.ts`, which never fails to match.
+- **The MCP Apps host bridge never removed its `window` listener.** `HostBridge.dispose()` releases it, and `EmbedSurface` calls it on unmount — a bridge that is never disposed keeps its listener, and everything it closes over, alive for the life of the page. `tests/agents.test.tsx` holds it twice over: that a disposed bridge delivers nothing to its listeners, and that the handler it added to `window` is the one it takes off (the second is what catches the leak — the first passes on `listeners.clear()` alone).
+- **`scripts/brand.ts` silently did nothing for part of a new accent.** It patched an `ACCENT_SWATCH` map that no longer exists in `src/lib/preferences.ts`; a `String.replace` with no match writes nothing. Removed.
+- **`scripts/keyboard.ts` ignored `--extra`.** `pnpm verify --extra /orders/1` walked the configured detail pages here while the audit, the presses and vitals walked the ones that were asked for.
+- **`scripts/verify.ts` looked for the assistant only in `app/`.** A project that keeps its routes under `src/app` — which `adopt` supports, and which `APP_DIR` already models — would have had its whole assistant walk-through skipped, silently.
+- **`scripts/fake-llm.ts` used the older entry-point guard** while every other script uses `import.meta.main`.
+- **`app/(dashboard)/keys/actions.ts` stamped every key's owner as "Maya Chen"** instead of the product's own person (`app.user.name`).
+- **The Atlas did not list the Members page.** `/system/pages/members` did not exist, so the page's own specification was unreachable from the Atlas; `docs/surfaces.md`'s page inventory omitted Members and API keys.
+- **`next.config.ts` did not trace `app/**/*.md` for `/system`.** The Atlas reads its page specifications from `app/`, and today those routes are static — a runtime render would have read them as empty.
+- **`docs/surfaces.md`'s page inventory named two embed views that do not exist** (`request`, `customer`) and left out the one that does (`/embed/proposal`). Every page's own specification already said "not offered" for those two; the table agrees with them now and lists the proposal view. The same guide credited the token bridge to `EmbedFrame`; `EmbedSurface` is what applies it, on every embed route. `check.ts` has a rule now, so this cannot drift again: every `/embed/<name>` a document writes is a route, and every view the inventory's own column offers is one.
+- **Twenty-four sizes written into the specifications were the tokens' old values.** The radius scale was retuned (4/6/8/12/16 to 5/8/10/16/24), the control heights with it (30/36/44 to 32/38/46) and the row height (36/48 to 38/52), and eighteen specifications kept the old numbers: Banner, Button, Card, Dialog, Icon button, Input, Menu, Pagination, Popover, Segmented, Select, Skeleton, Table, Textarea, Toast, Tooltip, Export button and `docs/surfaces.md`. A product sizing a corner, a control or a row from the specs — the card contract is what CONTRIBUTING points a reader to — was a few pixels out, and nothing said so. `check.ts` has a rule now: a token annotated with a px value must be that value, comfortable or compact, and a token whose own value is not a plain px (a clamp, a var) is left alone.
+- **Four controls were under 44px on a phone**, which the standard requires of every control on a coarse pointer (`.hit` gives a control a 44px target; its siblings already carried it). The Appearance menu's trigger (`size-8`), the alerts panel's "Mark all read" and the filter bar's phone-only "Clear" — text buttons, which the box-link rule never covered — and `AskAbout`'s button (`h-7`). Nothing caught them because the audit only measures a control when it is on screen, and on a product page these live in a closed drawer, popover or sheet: the components' own previews, which nothing audited, are where they showed.
+- **The App Mark preview drew its light specimen as light text on a light ground** (1.05:1 — the audit fails that contrast). `data-theme` redefines the variables in its own scope, but `color` had already been resolved on `body` from the page's theme; the Planes preview carries `text-ink` for exactly this reason and the App Mark preview did not.
+- **The Motion preview demonstrated `.link` as a box control.** `.link` is a link inside a sentence — that is why it is exempt from the 44px rule — and shown bare in a flex row it blockifies, losing both the exemption and the box-link hit area, so the specimen stood for a control the class is not. A box link is `.link inline-flex`, as the Atlas's own links are.
+
+### Changed
+
+- **One parser splits both figures.** `FeaturedMetric` had its own regex with a hard-coded `$€£`; it and `MetricTile` share `splitFigure` now, which is total and takes any leading symbol.
+- **The card's interactive hover is the shadow its own spec, preview and token catalogue name** (`shadow-raise`, "an interactive card under the pointer") — the code had used `shadow-halo`, which belongs to the featured card.
+- **The button's hover documentation matches the button**: a 5% brightness step over `dur-hover`, because the fill is a gradient image that a colour change cannot show through. The README and the preview said `accent-hover`.
+- **The Sheet's close fade and the token catalogue's growing bar use the duration tokens they had written as literals.** The sheet's leave faded over a hard-coded `160ms` — the *hover* duration — while its own scrim and every other overlay going away use `--dur-exit`; it does now too, so a sheet and the scrim under it finish together. `token-view.tsx`'s bar grew over `900ms`; it uses `--dur-grow`. `docs/surfaces.md`'s token bridge lists `surface-raised` and `radius-md`, which the bridge has always mapped.
+
+### Removed
+
+- **`.sheet-right-in`, `.sheet-up-in` and the `m-sheet-right` keyframe** from `motion.css`: nothing referenced them, and the Sheet animates inline (its README claimed motion.css had no right-edge keyframe; it did).
+- **`PopoverAnchor`**, exported and named nowhere (the preview uses `PopoverClose`, which stays; the README now names it).
+- **Dormant exports**: `ROOT`/`Token`/`BRIDGE`/`buildCss`/`buildTheme` in `scripts/tokens.ts`, `PAIRS`/`context`/`resolve`/`colorOf` in `scripts/contrast.ts`, `LAYERS`/`CardEntry` in `scripts/registry.ts`, `VerifyConfig` in `scripts/verify.config.ts`, `adoptSet` in `cli/src/adopt.ts`, and the Atlas's internal types (`TOKEN_VIEWS`, `DOCS`, `parseSpec`, `SectionId`, `Entry`, `slug`, `HostSimulator`, `Card`, `TokenMeta`).
+- **The `rail-collapsed` token**: declared since the first commit, referenced by no component, spec, bridge or script.
+- **`DEMO_STALE_AFTER_MS`** (and the unused `Customer`/`StatusClass` type exports): nothing imported them.
+
+### Breaking
+
+- **The `rail-collapsed` token is gone** (`tokens/core.tokens.json`, and `src/styles/tokens.css` with it). Nothing a
+  product keeps referenced it — no component, specification, bridge or script — so a stylesheet of your own that reads
+  `var(--rail-collapsed)` was already falling back to nothing. The rail's width is `rail-width`; below 1024px it is a
+  drawer, which is not a collapsed rail.
+- **Dormant exports removed from Meridian's own scripts**: `ROOT`, `Token`, `BRIDGE`, `buildCss` and `buildTheme` in
+  `scripts/tokens.ts`; `PAIRS`, `context`, `resolve` and `colorOf` in `scripts/contrast.ts`; `LAYERS` and `CardEntry` in
+  `scripts/registry.ts`; `VerifyConfig` in `scripts/verify.config.ts`; `adoptSet` in `cli/src/adopt.ts`; and the Atlas's
+  internal types. A product that imported one of these was reaching into a generator; nothing that ships depends on
+  them.
+- **`PopoverAnchor` is gone**, and `.sheet-right-in`/`.sheet-up-in` with the `m-sheet-right` keyframe. The first was
+  exported and named nowhere; the others were referenced by nothing, and the Sheet animates inline.
+- **`DEMO_STALE_AFTER_MS`** and the unused `Customer`/`StatusClass` type exports are gone from the sample fixtures.
+
+Nothing a product renders changes shape because of any of this: `pnpm gate` proves that every export of `src/lib` and
+`src/data` is imported by a file a product keeps, and it passes.
+
+## [0.3.0] · 2026-10-04
+
+Three field reports from products built on Meridian (issues #3, #4 and #5), taken as proposed where the proposal held and differently where it did not. Everything here is a fix to what the template ships, or a hole an adopting product could not fill itself.
+
+### Added
+
+- **The assistant renders a reply as markdown.** A real model answers in markdown, and the panel was showing it literally — `**High risk:**`, `- ` bullets and `|---|` table rules on screen. Each text part goes through `Prose` at `sm` (`src/components/patterns/assistant/text.tsx`), the same reader the rest of the product uses, so raw HTML stays text and every URL passes `safeMarkdownUrl`. The reply block carries `data-assistant-text`, a stable handle for a check; the person's own message is still plain text, as typed. `scripts/fake-llm.ts` gained one scripted markdown reply and `scripts/assistant.ts` asserts the list, the bold and the table are elements with the markup characters gone.
+- **`CardHeader` `wrap`**, for a title that is the point of the card — an objective, a record's name — rather than a label in a list where one line and an ellipsis is right.
+- **`FormSection as="div"` and `flush`.** A settings page that holds a table had nowhere to put it: `FormSection` always wrapped its card in a `<form>` with a save bar, and its body was a padded `fieldset`, so it could hold neither a table that runs edge to edge nor a form of its own (forms cannot nest). `as="div"` is the same head and card with no `<form>`, and `flush` drops the body's padding for the table. `SettingRow` sits outside `FormSection` unchanged, for a switch that applies at once.
+- **Collections: `derived`, and the write shapes a real data layer can honour.** `create` and `update` took `Omit<T, K>`, which demands every field of the record — including ones a write never takes (a worked-out score, a band, joined data) — so a database-backed product had to cast around the type. They now take a plain record validated by `fields`, which is what the store always did at runtime. `derived` names the read-only fields: a page reads them, the assistant may filter on them, and `patchOf` keeps them out of every change.
+- **`verify` refuses to run against a data URL that is not on this machine.** It presses every control, Delete included, and an adopted app's `DATABASE_URL` comes from `.env` — so on a first outage, or any day, those presses landed on whatever that URL names. Name extra variables in `dataUrls`, and set `allowRemoteData: true` only when you know what the presses reach. verify also prints an estimate and each phase as it goes, and names `--quick` and `--no-vitals` up front.
+- **`PERIOD_SHORT`** in `src/lib/period.ts`, beside `PERIOD_LABEL`: a product that adds its own period (a 24-hour one) edits that one file, and `PeriodSelect` follows — it no longer carries a `Record<Period, string>` of its own that fails to type check the moment the vocabulary moves.
+- **A timeline bar that continues past a fixed window is squared off** on the side that continues. Work that started before `from` or runs past `to` used to read as work that began at the window's edge.
+
+### Changed
+
+- **`FilterBar` reads its own width, not the window's** (a container query, `@max-[52rem]`). With the assistant's column open at 1440px the bar sat in about 900px and still laid out for a wide window: the search shrank to a few characters while every filter stayed. This is the rule the table already followed.
+- **`Segmented` scrolls sideways with the edge fade** when its labels are wider than the track, rather than running off the card. Six options with counts in their labels ("All 37 · Idea 3 · Scored 25") no longer clip at 390px.
+- **`CardBody flush` clips a `Table` as its first child and drops the header row's top border.** Directly under a card's own edge there was a second line, and the header's sunk fill squared off the card's rounded top corners — most visible in dark. A second table in the same body keeps its border.
+- **The not-found screen and the error view read the home page's name from `nav`**, never "Overview". A product whose front page is a ranked list names it once in `src/app.config.ts`, and the buttons follow. The error view's second way out is `Check Health` where the product has that page and the home page where it does not.
+- **`check.ts` treats `src/lib/format.ts` and `src/lib/color.ts` as the toolkit they are.** A product that re-syncs `src/lib` and removes the samples was failing Meridian's own gate on Meridian's own files (`formatCost`, `oklchToRgb`: "nothing a product keeps imports"), and had to strip the export keywords to get through. Every file under `src/lib` that Meridian ships now passes in a product, unchanged.
+
+### Fixed
+
+- The assistant labelled a question with the masthead `h1`, which on a detail page is the record's name with its status badge run into it ("REC-1042high risk · 0.64"). The label now comes from the route's own `document.title` ("Record REC-1042"), with the masthead as the fallback.
+- A keyboard focus that scrolled into view could land under the 56px sticky top bar. The scroll region now carries `scroll-pt-16`, so a focused control comes to rest clear of it (WCAG 2.4.11).
+- `docs/assistant.md` and `.env.example` say that a gateway names models `<provider>.<model>` and to copy the id from its `GET /models` — the prefix is part of the name.
+
+### Breaking
+
+- `Collection.create` and `Collection.update` (`src/lib/collection.ts`) take `Record<string, unknown>` instead of `Omit<T, K>` and `Partial<Omit<T, K>>`. A caller that passed a fully typed record still compiles; a data layer that had to cast now does not. `derived` is new and optional.
+- `FormSection` gained `as` and `flush`; both default to today's behaviour, so nothing that does not pass them changes.
+
 ## [0.2.0] · 2026-10-04
 
 The first release on npm. A team brings Meridian into its own dashboard with one sentence to its coding agent:
@@ -61,7 +164,7 @@ projects (issues #1 and #2), and the console's own assistant.
 
 ## [0.1.0] · 2026-10-03
 
-The first release: a dashboard design system and a working template, built on the Zandro pattern and register.
+The first release: a dashboard design system and a working template, built on the layered-card pattern and the dark, lit register of 0002.
 
 ### Added
 

package/payload/CONTRIBUTING.md

@@ -84,7 +84,7 @@ Write the status on the line under the title: `Status: beta`.
 | `pnpm tokens` | Generates the token CSS and the Tailwind bridge from `tokens/` (`--check` only compares) | After any token change |
 | `node scripts/contrast.ts [--all]` | Every specified foreground on its background, in every theme and accent, and the chart palette's colour-vision checks | Gate |
 | `node scripts/registry.ts` | Regenerates the Atlas registry from the card folders (`--check` only compares) | After adding or renaming a card |
-| `node scripts/check.ts` | Every card has its README and preview, every README follows the anatomy, no literal colour in components, every token a spec names exists | Gate |
+| `node scripts/check.ts` | Every card has its README and preview, every README follows the anatomy, no literal colour in components, every token a spec names exists and is written with its own value, and every embed view a document offers is a route | Gate |
 | `pnpm typecheck`, `pnpm test` | TypeScript and the behaviour tests | Gate |
 | `node scripts/audit.ts` | With the app running: every page and embed view at 2560, 1440, 1024, 768 and 390px in both themes (embeds at 720 and 420 on a simulated host ground). Fails on sideways scroll, text clipped without an ellipsis, a control with no accessible name, more than one page scroller, rendered text under its WCAG minimum, a Tab stop with no visible focus ring (it presses Tab through the page), and any uncaught exception or console error. Prints the design metrics: type sizes, weights, radii and the hierarchy ratio | Before release |
 | `node scripts/interactions.ts` | With the app running: presses every control on every page (mouse at 1440px, taps at 390px) and follows every link. Fails on a control that changes nothing, one something covers, and a link that answers 4xx. |

package/payload/README.md

@@ -72,7 +72,7 @@ Dark is the default, written on `:root`; the light theme follows the operating s
 | `scripts/` | Generators, gates, `brand.ts` and `verify.ts` (see `CONTRIBUTING.md`) |
 | `skills/zz-meridian/` | The agent skill (Claude Code, Codex) that builds dashboards on this template or brings it into yours |
 | `cli/` | The `zz-meridian` npm package: `create`, `adopt` and `skill`, its build, its smoke test and the fixture app (`docs/distribution.md`) |
-| `.github/workflows/release.yml` | The release: gates, the consumer path from the tarball, then npm with provenance, then the tag (`.claude/commands/release-meridian.md`) |
+| `.github/workflows/release.yml` | The release: gates, the consumer path from the tarball, then npm with provenance, then the tag (`.claude/commands/release.md`) |
 
 ## Bring Meridian into your dashboard, in one sentence
 

package/payload/app/(dashboard)/README.md

@@ -17,7 +17,7 @@ Status: beta
 
 Everything in rows 1 and 2 shares one Meridian: point at a day in either chart and the featured figure, the tiles and both charts read that day.
 
-Below 1024px every row stacks: the featured card first, then the tiles (two across from 34rem, one below), then the cards. At 390px the masthead's actions wrap under the title and the period select stays visible; Export moves into the command palette.
+Below 1024px every row stacks: the featured card first, then the tiles (two across from 34rem, one below), then the cards. At 390px the masthead's actions wrap under the title and the period select stays visible; Export is not offered on a phone (`max-sm:hidden`), and the command palette carries destinations and appearance, not the page's actions.
 
 ## States
 
@@ -27,7 +27,7 @@ Below 1024px every row stacks: the featured card first, then the tiles (two acro
 | Empty (no traffic yet) | The featured card says "No requests yet" with a link to API keys; tiles show dashes, never zeros |
 | Partial (a series missing) | That tile shows a dash and "Not measured"; the chart breaks its line over missing days |
 | Stale | Freshness turns to warning: "Stale · updated 47 min ago" |
-| Error | `error.tsx`, inside the shell at the data width, like every page: the title says the view did not load and nothing was changed; one card says retrying usually works, with Retry (primary), Check Health, and the reference |
+| Error | `error.tsx`, inside the shell at the data width, like every page: the title says the view did not load and nothing was changed; one card says retrying usually works, with Retry (primary), a second way out read from `nav` (Check Health where the product has one, the home page where it does not), and the reference |
 
 ## Data
 

package/payload/app/(dashboard)/error.tsx

@@ -2,6 +2,7 @@
 
 import Link from 'next/link';
 import { RotateCw } from 'lucide-react';
+import { nav } from '@/app.config';
 import { PageFrame } from '@/components/base/shell';
 import { Button } from '@/components/ui/button';
 import { Card } from '@/components/ui/card';
@@ -10,8 +11,15 @@ import { EmptyState } from '@/components/ui/empty-state';
 /**
  * A page that failed to load: in place, inside the shell, so the rail and the way out stay where they were. The title
  * says what happened once; the card says what to do about it, with the reference support will ask for.
+ *
+ * The second way out is read from `nav`, never written here: not every product has a Health page, and one that does not
+ * would otherwise offer a button to an address that leads nowhere while the reader is already having a bad day.
  */
 export default function DashboardError({ error, reset }: { error: Error & { digest?: string }; reset: () => void }) {
+  const items = nav.flatMap((g) => g.items);
+  const health = items.find((i) => i.href === '/health');
+  const home = items.find((i) => i.href === '/');
+  const elsewhere = health ?? home;
   return (
     <PageFrame kicker="Something failed" title="This view did not load" description="The data behind it did not arrive. Nothing was changed.">
       <Card className="arrive">
@@ -21,11 +29,11 @@ export default function DashboardError({ error, reset }: { error: Error & { dige
           action={
             <>
               <Button variant="primary" icon={<RotateCw />} onClick={reset}>Retry</Button>
-              <Button asChild><Link href="/health">Check Health</Link></Button>
+              {elsewhere ? <Button asChild><Link href={elsewhere.href}>{health ? `Check ${health.label}` : `Go to ${elsewhere.label}`}</Link></Button> : null}
             </>
           }
         >
-          If it fails again, Health says whether an incident is under way. Reference <span className="font-mono text-ink">{error.digest ?? 'client'}</span>
+          {health ? `If it fails again, ${health.label} says whether an incident is under way.` : 'If it fails again, it is likely to stay that way until someone looks at the data behind it.'} Reference <span className="font-mono text-ink">{error.digest ?? 'client'}</span>
         </EmptyState>
       </Card>
     </PageFrame>

package/payload/app/(dashboard)/keys/actions.ts

@@ -4,6 +4,7 @@
 // check as the layout's and the assistant route's.
 import { randomBytes } from 'node:crypto';
 import { z } from 'zod';
+import { app } from '@/app.config';
 import { clock, keys } from '@/data/collections';
 import type { ApiKey } from '@/system/fixtures/sample-records';
 
@@ -16,7 +17,7 @@ const draft = z.object({
 /** Creates a key and returns it: the only moment its full secret leaves the server for a banner. */
 export async function createKey(input: z.input<typeof draft>): Promise<ApiKey> {
   const { name, env, scopes } = draft.parse(input);
-  return keys.create!({ name, env, scopes, owner: 'Maya Chen', created: clock().toISOString(), lastUsed: null, secret: `zzm_${env}_${randomBytes(16).toString('hex')}` });
+  return keys.create!({ name, env, scopes, owner: app.user.name, created: clock().toISOString(), lastUsed: null, secret: `zzm_${env}_${randomBytes(16).toString('hex')}` });
 }
 
 export async function revokeKey(id: string): Promise<void> {

package/payload/app/not-found/README.md

@@ -15,19 +15,19 @@ For an address outside the console, a standalone screen on the lit ground, from
 | Sentence | "This page isn't here." at `text-display`: the protagonist |
 | Lead | "The link may be mistyped or out of date, or what it pointed to has been removed." |
 | Address | A sunk field, body-size mono: the part that exists as a link to that page, the part that does not under a dashed critical rule, and one line saying which is which |
-| Actions | Back to the nearest page (primary, `lg`), then Go to Overview when that is somewhere else |
+| Actions | Back to the nearest page (primary, `lg`), then a link to the home page when that is somewhere else (`nav`'s label for `/`) |
 
 Inside the console the screen is `MissingPage` (`src/views/missing-page.tsx`): a record page renders it itself when its ID is missing (`/requests/<id>`), and `app/(dashboard)/not-found.tsx` renders it for any other `notFound()`. A record page renders rather than throws because a `notFound()` thrown inside the dashboard's loading boundary shows only once the JavaScript arrives, which on a slow phone put the largest paint past 2.5s; the page keeps `noindex`. The rail stays; the sentence becomes the page title over the same lead at the data width, on the same left edge as every page, and one card holds the address at `text-xl` as the protagonist and the same actions (`md`). A miss at the root there offers Search pages (the command palette) as the second action.
 
-The words come from `src/views/not-found.tsx`; the address and the actions from `src/views/not-found-address.tsx`, once.
+The words come from `src/views/not-found.tsx`; the address and the actions from `src/views/not-found-address.tsx`, once. The home page's own name is read from `nav` (`homeLabel`), not written here: a product whose front page is a ranked list, not "Overview", names it once in `src/app.config.ts` and both buttons follow.
 
 ## States
 
 | State | What shows |
 |---|---|
-| A missing record (`/requests/req_9x7k`) | `/requests` links to Requests; `/req_9x7k` is marked; "Requests is still here. Nothing in it answers to req_9x7k."; Back to Requests, Go to Overview |
+| A missing record (`/requests/req_9x7k`) | `/requests` links to Requests; `/req_9x7k` is marked; "Requests is still here. Nothing in it answers to req_9x7k."; Back to Requests, Go to the home page (`nav`'s label: Overview here) |
 | A deeper miss (`/settings/billing/invoices/2026`) | `/settings` links to Settings; the rest is marked; "Settings is still here; the rest of the address leads nowhere." |
-| No part exists (`/this-page-does-not-exist`) | `/` links home; the rest is marked; "No page in ZZ Meridian lives at this address."; Go to Overview (and, in the console, Search pages) |
+| No part exists (`/this-page-does-not-exist`) | `/` links home; the rest is marked; "No page in ZZ Meridian lives at this address."; Go to the home page (and, in the console, Search pages) |
 | A long ID (60 characters or more) | The address breaks anywhere rather than overflowing; the sentence says "the address above" instead of repeating an ID over 32 characters |
 | Percent-escapes (`/requests/a%20b`) | Decoded for reading where they decode, shown as typed where they do not |
 | A trailing slash | Ignored: `/requests/` is Requests itself, not a miss |

package/payload/app/system/preview/[section]/[card]/page.tsx

@@ -2,7 +2,7 @@ import { notFound } from 'next/navigation';
 import { CARDS } from '@/system/registry';
 import { PreviewStage } from './stage';
 
-/** One card's preview, bare: what the Atlas frames, and what screenshots and audits open. ?theme=dark&accent=iris&density=compact */
+/** One card's preview, bare: what the Atlas frames, and what screenshots and audits open. ?theme=dark&accent=indigo&density=compact */
 export default async function Page({ params }: { params: Promise<{ section: string; card: string }> }) {
   const { section, card } = await params;
   const c = CARDS.find((x) => x.section === section && x.id === card);

package/payload/decisions/0001-react-and-the-repository.md

@@ -4,7 +4,7 @@ Date: 2026-10-03 · Status: accepted
 
 ## Context
 
-Meridian follows the Zandro design system's pattern: layered cards, each specified before it is built, tokens in DTCG, gates that compute what can be computed. Zandro ships framework-agnostic CSS with HTML previews, because it is rebuilt on several platforms. Every dashboard Meridian serves is built with Next.js, React and Tailwind, so a CSS-only system would be ported by hand into every new dashboard.
+Meridian follows the pattern of the design system that came before it: layered cards, each specified before it is built, tokens in DTCG, gates that compute what can be computed. That system ships framework-agnostic CSS with HTML previews, because it is built for several platforms. Every dashboard Meridian serves is built with Next.js, React and Tailwind, so a CSS-only system would be ported by hand into every new dashboard.
 
 ## Decision
 

package/payload/decisions/{0002-zandro-register.md → 0002-the-register.md}

@@ -1,10 +1,10 @@
-# 0002 · Zandro's register: dark first, lit, one protagonist
+# 0002 · The register: dark first, lit, one protagonist
 
 Date: 2026-10-03 · Status: accepted
 
 ## Context
 
-The first rendering of Meridian used a neutral light canvas, a 28px page title and four equal tiles: tidy, correct, and indistinguishable from any dashboard of the last decade. The owner rejected it as dated and asked for the language of the Zandro design system, which reads at a glance as a current, premium product.
+The first rendering of Meridian used a neutral light canvas, a 28px page title and four equal tiles: tidy, correct, and indistinguishable from any dashboard of the last decade. The owner rejected it as dated and asked for the register of the earlier design system (0001), which reads at a glance as a current, premium product.
 
 ## Decision
 
@@ -16,5 +16,5 @@ The first rendering of Meridian used a neutral light canvas, a 28px page title a
 
 ## Consequences
 
-- The system shares a family resemblance with Zandro; its own identity is the Meridian cursor, the three surfaces and the agentic layer.
+- The system shares that family resemblance; its own identity is the Meridian cursor, the three surfaces and the agentic layer.
 - Every component is checked in both themes, as before; the dark theme is the one quoted in specifications.

package/payload/decisions/0006-quiet-light.md

@@ -4,7 +4,7 @@ Date: 2026-10-03 · Status: accepted · Amends 0002
 
 ## Context
 
-After 0002, the owner asked for the overall feeling to be more refined and less loud: premium, modern and elegant without showing off. They pointed to crypto-zentry, whose calm comes from soft, diffuse light everywhere and nothing loud anywhere: low-alpha orbs on the ground, translucent glass cards that let the light through, a faint halo around a card and a gradient border that appears only under the pointer, plain 2px chart lines, a gentle two-stop gradient on the one primary action, and gradient text only on the hero phrase. The first Meridian line glow read as a smudge on white.
+After 0002, the owner asked for the overall feeling to be more refined and less loud: premium, modern and elegant without showing off. They pointed to the calm of the earlier system — soft, diffuse light everywhere and nothing loud anywhere: low-alpha orbs on the ground, translucent glass cards that let the light through, a faint halo around a card and a gradient border that appears only under the pointer, plain 2px chart lines, a gentle two-stop gradient on the one primary action, and gradient text only on the hero phrase. The first Meridian line glow read as a smudge on white.
 
 ## Decision
 

package/payload/decisions/0007-the-name.md

@@ -4,7 +4,7 @@ Date: 2026-10-03 · Status: accepted
 
 ## Context
 
-The system was first named Meridian on its own, after its signature: one time cursor, a meridian line, shared by every chart and tile on a page. The owner's products form one family (zz-stack, the zz-stack console, this repository), and a standalone brand made the system read as someone else's.
+The system was first named Meridian on its own, after its signature: one time cursor, a meridian line, shared by every chart and tile on a page. The owner's products form one family, and a standalone brand made the system read as someone else's.
 
 ## Decision
 

package/payload/decisions/0009-a-package-that-copies.md

@@ -24,8 +24,8 @@ so a team that adopted Meridian never receives a fix.
 - Every copy is recorded in `.meridian/manifest.json` in the project (the version, each file's hash, the brand
   arguments), so a later `npx zz-meridian@latest update` can tell an untouched file from one the team changed.
 - The design system and the package share one version, under the semver rules in `CHANGELOG.md`.
-- The package is published by CI (npm trusted publishing with provenance), following the release pipeline of
-  multi-model-agent, with the tag created last.
+- The package is published by CI (npm trusted publishing with provenance), following the release pipeline of the
+  owner's earlier packages, with the tag created last.
 
 ## Consequences
 

package/payload/docs/assistant.md

@@ -14,7 +14,7 @@ Four variables, read from the environment on every request, so one build serves
 |---|---|
 | `ASSISTANT_PROVIDER` | `anthropic`, or `openai-compatible` for any service that speaks the OpenAI chat-completions format |
 | `ASSISTANT_API_KEY` | The provider's key. Required: the approval secret is derived from it. |
-| `ASSISTANT_MODEL` | The model's id, as the provider names it |
+| `ASSISTANT_MODEL` | The model's id, as the provider names it. A gateway such as LiteLLM names models `<provider>.<model>` — copy the id exactly as its `GET /models` lists it, and take it as it comes. |
 | `ASSISTANT_BASE_URL` | The provider's address. Required for `openai-compatible`; optional for `anthropic`. |
 
 If the key or the model is missing, or the provider is anything else, or `openai-compatible` has no address, the assistant is off. `.env.example` lists the four, commented, with no values.

package/payload/docs/benchmark.md

@@ -1,6 +1,6 @@
 # Benchmark
 
-Meridian held to the bar of award-winning sites (Awwwards, Webby, FWA) and of the systems it learned from (Zandro, crypto-zentry, the zz-stack console), criterion by criterion: what we did, the evidence, and what is still open. Measured on 2026-10-03 with `node scripts/audit.ts` (every page and embed view at 2560, 1440, 1024, 768 and 390px, both themes) and `node scripts/contrast.ts` (every pair in every theme and accent).
+Meridian held to the bar of award-winning sites (Awwwards, Webby, FWA) and of the systems it learned from, criterion by criterion: what we did, the evidence, and what is still open. Measured on 2026-10-03 with `node scripts/audit.ts` (every page and embed view at 2560, 1440, 1024, 768 and 390px, both themes) and `node scripts/contrast.ts` (every pair in every theme and accent).
 
 ## Scorecard
 
@@ -17,8 +17,8 @@ Meridian held to the bar of award-winning sites (Awwwards, Webby, FWA) and of th
 
 ## What changed because of the benchmark
 
-- **The register** (decision 0002). The first render, a neutral light canvas with 28px titles and four equal tiles, was rejected as dated. Meridian adopted Zandro's register: dark first, a lit ground, a dramatic type scale, one featured card.
-- **Quiet light** (decision 0006). Learning from crypto-zentry, the glow moved from the data to the frame: translucent surfaces, a lit edge and a faint halo on the featured card, a whisper of light under the line (14% on light, 24% on dark, set 2px below it), a primary action turning toward violet, one solid accent phrase per screen. The louder feature shadow, the solid accent borders and the grain were removed.
+- **The register** (decision 0002). The first render, a neutral light canvas with 28px titles and four equal tiles, was rejected as dated. Meridian adopted that register: dark first, a lit ground, a dramatic type scale, one featured card.
+- **Quiet light** (decision 0006). Learning from that calm, the glow moved from the data to the frame: translucent surfaces, a lit edge and a faint halo on the featured card, a whisper of light under the line (14% on light, 24% on dark, set 2px below it), a primary action turning toward violet, one solid accent phrase per screen. The louder feature shadow, the solid accent borders and the grain were removed.
 - **Tables.** The lead column no longer takes all the slack (about a third, the rest spread by content); columns sit 32px apart; a text column after a number gets 16px more; a fixed-width method chip lines up every route.
 - **Performance found by the audit.** A repeated grain texture under translucent cards stalled rasterisation at device scale (a 2× capture timed out past 30 seconds; without it, under a second), and a blend mode on a full-screen layer left charts painted stale. Both are gone.
 - **Motion, evaluated with motion on.** The light under the featured line now draws with the line instead of fading in ahead of it; line, light and area arrive together over 820ms (93% drawn by 250ms, settled by 550ms). The Atlas hero's cursor sweeps the month once and rests, instead of looping.
@@ -30,11 +30,11 @@ Meridian held to the bar of award-winning sites (Awwwards, Webby, FWA) and of th
 - **A last look, by eye, at 1440 and 390px in both themes.** Three things the audit cannot see were fixed. A sparkline's troughs ran along the card's bottom edge and into its rounded corner; the lowest point now floats a quarter of the height above the floor while the area still fills to it. An incident title broke after the hyphen in "eu-west-1"; hyphenated identifiers in titles now hold together. The incident timeline set its times as spaced mono capitals ("3 6 M I N"); they are now captions with tabular figures. On phones, the uptime card's service grid cut "Inference API" short to make room for a latency figure; the grid now shows names only there, and latency stays in the service list just below.
 
 - **Pressing everything, not only measuring it.** The owner found that the bell did nothing and the tab had no icon. A probe that pressed every control on every page (mouse at 1440px, taps at 390px) then found more that the audit could not see, because the audit measured pages and never used them: the workspace switcher, the alerts bell, every Export, Subscribe to updates, Invite customer and Continue with SSO did nothing; the tiles' info buttons opened only on hover, so a phone could never read them; two items in a request's menu only announced themselves in a toast. Each now does its job (a workspace menu, an alerts panel, a CSV download, a toggle, an invite sheet, an email-first SSO step, a tap-to-open explanation, a copied link). `scripts/interactions.ts` presses every control and follows every link on every page, and `pnpm verify` fails on any that does nothing.
-- **Glass that was not glass.** Meridian resets Tailwind's blur scale and never defined its own, so every `backdrop-blur` rendered nothing: the stuck top bar, the rail and the shell tools were tinted, not frosted, and text showed through them. Blur is now a token (`blur-sm` 8px, `blur-md` 12px, `blur-xl` 24px), and the gate fails a blur utility outside it.
+- **Glass that was not glass.** Meridian resets Tailwind's blur scale and never defined its own, so every `backdrop-blur` rendered nothing: the stuck top bar, the rail and the shell tools were tinted, not frosted, and text showed through them. Blur is now a token (`blur-md` 12px, `blur-xl` 24px), and the gate fails a blur utility outside it.
 - **Tables that clipped their last column.** Columns dropped by the window's width, which ignores the rail, so between 768 and 1440px the API keys table (and Customers and Requests at 1024 to 1280px) ran wider than its card and the card cut the actions off; on a phone the Analytics endpoints table cut off p95. Columns now drop by the table's own width (a container query), a lead column needs 160px on a narrow table, and the audit fails any table wider than its frame.
 - **A tab icon.** `app/icon.ts` draws the App mark in the default accent, read from the tokens at build, so a new brand repaints it.
 
-- **An independent critic, against the juries' criteria.** A reviewer that had not built Meridian rendered all 15 routes at 360, 768 and 1440px in both themes and scored them against the Awwwards, Webby, CSSDA and FWA criteria and Zandro's eight craft criteria. Scores: typography 8, whitespace 6, hierarchy 8, colour 7, motion 7, micro-interaction 7, responsiveness 6, originality 7. It failed three criteria: colour keeps its job, one type scale, and motion and speed. Fixed from its list:
+- **An independent critic, against the juries' criteria.** A reviewer that had not built Meridian rendered all 15 routes at 360, 768 and 1440px in both themes and scored them against the Awwwards, Webby, CSSDA and FWA criteria and the earlier system's eight craft criteria. Scores: typography 8, whitespace 6, hierarchy 8, colour 7, motion 7, micro-interaction 7, responsiveness 6, originality 7. It failed three criteria: colour keeps its job, one type scale, and motion and speed. Fixed from its list:
   - **Honesty:** uptime on a phone showed 30 bars beside the 90-day figure, so every day now shows. The trend's "Errors × 20" put a scaled number in a tooltip, so it is gone.
   - **Composition:**
     - the Atlas home's empty column and its raw changelog;
@@ -45,7 +45,7 @@ Meridian held to the bar of award-winning sites (Awwwards, Webby, FWA) and of th
     - a sign-in page with no proof (it now carries a live Meridian trend).
   - **Colour:** success rows are quiet and only 4xx, 5xx, past due and trial are coloured; the accent is off 35 "beta" marks and every customer sparkline; one freshness claim per view; one solid accent phrase instead of gradient text.
   - **Type:** headings descend one level at a time, and the audit fails a skip.
-  - **Motion:** every press control animates its press. Motion literals are tokens, and the gate fails a literal duration or a press transition without transform.
+  - **Motion:** every press control animates its press. Motion literals are tokens, and the gate fails a literal duration in `base.css`/`motion.css` or a press transition without transform.
   - **Touch:** every control and box link answers 44px on a coarse pointer, phones are emulated as touch, and the audit fails a smaller target.
   - **Small things:** embed heads keep Freshness whole; hour ticks follow 00/06/12/18; an in-app link uses → and a link out uses ↗.
 

package/payload/docs/distribution.md

@@ -1,6 +1,6 @@
 # Distribution: the `zz-meridian` package
 
-Status: v1 shipped in 0.2.0 (decision 0009). `update` is v2. Releasing: `.claude/commands/release-meridian.md`.
+Status: v1 shipped in 0.2.0 (decision 0009). `update` is v2. Releasing: the `/release` command (`.claude/commands/release.md`).
 
 ## The one sentence
 
@@ -20,7 +20,7 @@ rebuilding each page on Meridian's components, the fake API, and reading what `p
 - **Name** `zz-meridian`, unscoped (free on npm, and the shortest sentence). The command is `zz-meridian`
   (`bin: { "zz-meridian": "dist/cli.js" }`); a different bin name breaks `npx zz-meridian`.
 - **Where it lives**: `cli/` in this repository, its own `package.json`, built with `tsc` to `cli/dist/`; not a
-  workspace member, and outside the root's type check and lint. The repository root stays the template app, `private`,
+  workspace member, and outside the root's type check (the root lint does cover `cli/**`). The repository root stays the template app, `private`,
   renamed `zz-meridian-template`.
 - **Payload**: a snapshot of the template, built by `cli/scripts/build-payload.ts` into `cli/payload/` with `git archive
   HEAD`, never from a walk of the folder, so a build output, a local `.env` or an uncommitted edit cannot ship
@@ -43,7 +43,7 @@ clone-then-delete.
 Brings Meridian into the project in the current folder. It refuses, and copies nothing, when:
 
 - the git tree is dirty (`--allow-dirty` overrides): every change it makes must be reviewable as one diff, and revertable;
-- the project is not Next.js with the App Router and React 18 or newer: it exits with the Route B or C guidance from
+- the project is not Next.js with the App Router: it exits with the Route B or C guidance from
   `references/existing-project.md` instead.
 
 Then, in this order:
@@ -54,7 +54,7 @@ Then, in this order:
    fixture test (below) is what keeps it complete. A file of the same name that differs is never overwritten: `adopt`
    lists the conflicts and stops before writing anything.
 2. Merges dependencies and scripts into their `package.json`, keeping their versions where newer and compatible; adds
-   the `@/* → src/*` alias to `tsconfig.json` when theirs differs.
+   the `@meridian/* → ./src/*` alias to `tsconfig.json` when theirs differs (their own `@/*` is left as it is).
 3. Replaces their global stylesheet with the template's `app/globals.css`, keeping theirs as `app/globals.before.css`
    for the agent to port from.
 4. Runs `scripts/brand.ts --existing` with the brand arguments given (or the name from their `package.json`): the name,
@@ -114,11 +114,11 @@ checks.
 
 ## Release pipeline
 
-Modelled on multi-model-agent's (`.github/workflows/release.yml` there), one package instead of two:
+Modelled on the release pipeline of the owner's earlier packages, one package instead of two:
 
 1. **Dispatch**: `gh workflow run release.yml -f version=<v> [-f dry_run=true]`, from `master`. The version must equal
    `cli/package.json`'s and the tag must be unused.
-2. **Gates** (ubuntu): `pnpm gate`, `next build`, and the CLI's own tests.
+2. **Gates** (ubuntu): `pnpm gate`, `next build`, and the consumer smoke from the built tarball (step 4).
 3. **Pack and assert, before anything is irreversible**: `pnpm pack` in `cli/`, then on the tarball: the bin has its
    `#!/usr/bin/env node` line; `payload/skills/zz-meridian/SKILL.md` and its references are there; the component count
    matches the repository; no `node_modules/`, `tests/` of the CLI, `out/` or `.next/`.
@@ -128,27 +128,29 @@ Modelled on multi-model-agent's (`.github/workflows/release.yml` there), one pac
    - `create` into a clean folder, then `pnpm verify --quick --no-vitals`. Chrome is on ubuntu runners; Web Vitals
      measure the machine, so CI leaves them to the local run (`--no-vitals` is new in v1).
 5. **Publish** the tarball with `npm` 11.5.1 or newer through trusted publishing (OIDC), with `--provenance`. `pnpm
-   publish` does not perform the OIDC exchange; multi-model-agent learned this at 5.16.1.
+   publish` does not perform the OIDC exchange.
 6. **Tag `v<version>` last**, then the GitHub Release with the version's `CHANGELOG.md` section as its body.
 
-`dry_run` stops after step 4. A `/release-meridian` runbook (`.claude/commands/`) holds the judgement before dispatch:
-the version, the changelog section, the docs sweep, and the local `pnpm verify` with Web Vitals. A `scripts/set-version.ts`
+`dry_run` stops after step 4. A `/release` runbook (`.claude/commands/release.md`) holds the judgement before dispatch:
+the version, the changelog section, the docs sweep, and the local `pnpm verify` with Web Vitals. A `cli/scripts/set-version.ts`
 writes the version into `cli/package.json` and checks the root agrees.
 
 ## One-time setup (the maintainer, once)
 
-npm configures a trusted publisher only on a package that exists, so 0.2.0 was published from a laptop under the
-maintainer's npm account, with 2FA: the exact tarball the dry run tested, downloaded from its run. Then npmjs.com →
-`zz-meridian` → Settings → Trusted publisher: GitHub Actions, `zhixuan312` / `zz-meridian` / `release.yml`, and
-Publishing access set to require 2FA and disallow tokens. The real dispatch of 0.2.0 then found the version on the
-registry, skipped the publish, and finished the consumer check, the tag and the Release. From 0.2.1 on, CI publishes
-with provenance.
+npm configures a trusted publisher only on a package that exists. The maintainer created `zz-meridian` with a
+`0.0.0-stage` placeholder, then on npmjs.com → `zz-meridian` → Settings set the trusted publisher (GitHub Actions,
+`zhixuan312` / `zz-meridian` / `release.yml`, environment `npm`, "Allow npm publish" on) and Publishing access to
+require 2FA and disallow tokens. 0.2.0 itself was published from the maintainer's laptop, with 2FA, before the
+publisher was set: the exact tarball the dry run had tested (its sha512 matches), so it carries no provenance. The
+release run then found it on the registry, skipped the publish, and finished the consumer check, the tag and the
+Release. From 0.2.1 on, only the workflow, from `master` through the `npm` environment, can publish, and every
+version carries provenance. The placeholder can be deprecated.
 
 ## Versioning
 
 The design system and the package share one version, under the rules at the top of `CHANGELOG.md`: a removed or renamed
 token, prop or card is major; a new card, token or variant is minor; a corrected value is a patch. The current
-`[Unreleased]` section becomes the first release, `0.2.0`.
+`[Unreleased]` section becomes the next release.
 
 ## Phases
 

package/payload/docs/surfaces.md

@@ -30,7 +30,7 @@ Below 1024px the rail becomes a drawer (the same node, so nothing is defined twi
 | Menus and selects | Popover | Popover, at least 44px rows on touch | Menu, Select |
 | Charts | Full height, 6 to 8 date labels | Shorter (180px), 3 to 4 date labels; the Meridian follows the finger and the tooltip pins to the top edge | TrendChart |
 | Toolbar | Search, filters and view controls in one row | Search full width; filters behind one Filters button that opens a sheet | FilterBar |
-| Touch targets | 36px default control | Every control at least 44px tall where it is the main interaction (`control-lg`) | Button, Field |
+| Touch targets | 38px default control | Every control at least 44px tall where it is the main interaction (`control-lg`) | Button, Field |
 
 ### Embed (MCP Apps)
 
@@ -46,12 +46,13 @@ Meridian's rules for the embed surface:
 6. **Respect the safe area.** Padding adds `safeAreaInsets` on mobile hosts.
 7. **Act through the host.** A button in an embed calls a tool or sends a message; it never navigates the frame. A destructive action is never a bare button: it is a Proposal marked critical, and it runs only when the person approves.
 
-The token bridge, applied by `EmbedFrame` (`data-surface="embed"`), maps the host's variables onto Meridian's roles and falls back to Meridian's own value when the host sends nothing:
+The token bridge, applied by `EmbedSurface` on every embed route (`app/embed/layout.tsx`, `data-surface="embed"`), maps the host's variables onto Meridian's roles and falls back to Meridian's own value when the host sends nothing:
 
 | Meridian role | Host variable |
 |---|---|
 | `ground` | transparent |
 | `surface` | `--color-background-primary` |
+| `surface-raised` | `--color-background-primary` |
 | `surface-sunk` | `--color-background-secondary` |
 | `ink` | `--color-text-primary` |
 | `ink-2` | `--color-text-secondary` |
@@ -59,6 +60,7 @@ The token bridge, applied by `EmbedFrame` (`data-surface="embed"`), maps the hos
 | `line` | `--color-border-primary` |
 | `line-strong` | `--color-border-secondary` |
 | `font-sans` | `--font-sans` |
+| `radius-md` | `--border-radius-md` |
 | `radius-lg` | `--border-radius-lg` |
 
 What does not bridge: the accent, the status colours and the chart slots (they carry meaning, and the host has no equivalent), and figures (always Meridian's semi-condensed setting, so a number reads the same in the console and in a chat).
@@ -105,7 +107,7 @@ What exists, by layer, and how it changes per surface. "Same" means the card nee
 
 | Group | Cards |
 |---|---|
-| Actions | Button, Icon button, Menu, Link |
+| Actions | Button, Icon button, Menu |
 | Input | Field, Input, Textarea, Select, Checkbox, Radio group, Switch, Segmented, Search input |
 | Display | Card, Badge, Status dot, Delta, Avatar, Tooltip, Progress, Key value, Copy field, Kbd |
 | Navigation | Tabs, Breadcrumb, Pagination |
@@ -148,12 +150,15 @@ All components are surface-agnostic by construction: they size from control toke
 |---|---|---|---|---|
 | Overview | Dashboard: tiles, a trend, breakdowns | Tiles · trend 2/3 + ranked list 1/3 · composition 1/2 + activity 1/2 | One column | `overview` inline: three tiles and the trend; fullscreen: the page |
 | Requests | List: filter bar, data table, detail on select | Table | Card list | `requests` inline: the five latest that match the tool's query |
-| Request | Detail: head, facts, timeline | Facts 2/3 + context 1/3 | One column | `request` inline: the record card |
+| Request | Detail: head, facts, timeline | Facts 2/3 + context 1/3 | One column | Not offered; the inline list links here |
 | Analytics | Two-chart: heatmap, breakdowns | Heatmap full width · 1/2 breakdowns | Grouped heatmap | Fullscreen only |
 | Health | Operational: status list, incidents | Status 2/3 + incident 1/3 | One column | `health` inline: the status list |
-| Customers | List with sparklines | Table | Card list | `customer` inline: one customer's card |
+| Customers | List with sparklines | Table | Card list | Not offered |
+| API keys | List with destructive actions | Table | Card list | Not offered |
+| Members | List with destructive actions | Table | Card list | Not offered |
 | Settings | Reader: form sections | 832px column | One column | Not offered |
 | Sign in, Not found, Error | Standalone: one sentence at poster size | Centred | Same | Not offered |
+| Agent proposal | Showcase: a Proposal end to end | The embed view itself | One column | `proposal`: one Proposal card with its states and Approve (no Expand — the card is the whole view) |
 
 ## Adding to the inventory
 

package/payload/next.config.ts

@@ -4,7 +4,7 @@ const config: NextConfig = {
   reactStrictMode: true,
   devIndicators: false,
   // Card specifications (README.md next to each component) are read at build time by the Design Atlas.
-  outputFileTracingIncludes: { '/system/**': ['./src/**/*.md', './docs/**/*.md', './decisions/**/*.md', './*.md', './tokens/**/*.json'], '/icon': ['./tokens/**/*.json'] },
+  outputFileTracingIncludes: { '/system/**': ['./src/**/*.md', './app/**/*.md', './docs/**/*.md', './decisions/**/*.md', './*.md', './tokens/**/*.json'], '/icon': ['./tokens/**/*.json'] },
 };
 
 export default config;